• Perform widening on the current state with another state.

  For example,

  void exampleWidening() {
      AEState as1, as2;
      NodeID a = getNodeID("a");
      as1[a] = IntervalValue(1, 5); // as1: a in [1, 5]
      as2[a] = IntervalValue(3, 10); // as2: a in [3, 10]
      AEState widenedState = as1.widening(as2); // widenedState: a in [1, +inf]
  }
  

  Input: state (an AEState)

  Output: Widened state (an AEState)

• Load and store values associated with a variable ID.

  For example,

  void exampleLoadValue() {
      AEState as;
      NodeID a = getNodeID("a");
      NodeID p = getNodeID("p");
      NodeID malloc = getNodeID("malloc");
      as[p] = AddressValue(getMemObjAddress("malloc"));
      as.storeValue(p, IntervalValue(42, 42)); // Store 42 at address p
  
      AbstractValue loadedValue = as.loadValue(p);
  
      std::cout << loadedValue.toString() << std::endl;
  }
  

  Input: varId (a NodeID), val (an AbstractValue)

  Output: Loaded value (an AbstractValue, can be Interval Value or Address Value)

• Print the abstract trace for debugging purposes.

  For example,

  void examplePrintAbstractState() {
      AEState as;
      NodeID a = getNodeID("a");
      NodeID b = getNodeID("b");
  
      as[a] = IntervalValue(1, 5); // a in [1, 5]
      as[b] = IntervalValue(3, 7); // b in [3, 7]
  
      as.printAbstractState(); // Print the abstract trace for debugging
  }
  

  Input: None

  Output: None (prints the abstract trace)

-----------Var and Value-----------
Var2(b)             :  Value: [3, 7]
Var1(a)             :  Value: [1, 5]
-----------------------------------------

This section matches the current Assignment-3 skeleton. The authoritative interfaces are in Assignment-3/CPP/AEState.h, Assignment_3.h, AEHelper.cpp, and AEReporter.h.

Assignment 3 owns its abstract trace. It does not inherit from or delegate state storage to SVF's AbstractInterpretation.

Map<const ICFGNode*, AEState> preAbsTrace;
Map<const ICFGNode*, AEState> postAbsTrace;

AEState& getAEState(const ICFGNode* node);

• Each map value is an AEState, not a raw AbstractState.
• getAEState(node) returns the post-state and creates a default entry when necessary.
• postAbsTrace is a protected data member. It is indexed as postAbsTrace[node]; it is not called as postAbsTrace().
• There is no getAbsStateFromTrace() API in Assignment 3.
• AEState contains one AbstractState. Use raw() only when an SVF domain operation specifically requires the underlying type.

AEState and AbstractState both have value semantics in C++. Copying either one creates an independent state:

AEState& current = getAEState(node);
AEState snapshot = current;
AbstractState rawSnapshot = current.raw();

• getAEState(node) obtains the current node's post-state.
• The AbstractExecution facade supplies getAbsValue, updateAbsValue, loadValue, storeValue, getGepObjAddrs, getGepElementIndex, getGepByteOffset, and getAllocaInstByteSize.
• updateStateOnCall(const CallPE*) is supplied for phi-like actual-to-formal parameter propagation.

Use SVFUtil::isa<T>, SVFUtil::dyn_cast<T>, and SVFUtil::cast<T> to test and cast SVF objects.

The pre-implemented facade methods select the appropriate AEState using the ICFG node supplied explicitly or attached to a statement. You may instead obtain one state and call its methods directly:

AEState& state = getAEState(stmt->getICFGNode());
AbstractValue value = state.loadValue(pointer);
state.storeValue(pointer, value);

getElementIndex() and getByteOffset() are aliases for getGepElementIndex() and getGepByteOffset().

PhiStmt, CallPE, and SelectStmt are multi-operand statements. Do not assume that they use the two-operand AssignStmt interface.

Important address constants and predicates include IRGraph::NullPtr, NullMemAddr, AbstractState::isNullMem(addr), AbstractState::isBlackHoleObjAddr(addr), AbstractState::isVirtualMemAddress(addr), and AbstractState::getVirtualMemAddress(id).

Copy and load/store transfers can be expressed directly through the node's AEState:

const ICFGNode* node = stmt->getICFGNode();
AEState& state = getAEState(node);
state[lhsId] = state[rhsId];

const ValVar* loadPointer = SVFUtil::cast<ValVar>(load->getRHSVar());
state[load->getLHSVarID()] = state.loadValue(loadPointer);

const ValVar* storePointer = SVFUtil::cast<ValVar>(store->getLHSVar());
state.storeValue(storePointer, state[store->getRHSVarID()]);

• node->getInEdges() and edge->getSrcNode() enumerate incoming states.
• IntraCFGEdge condition and successor-value queries identify the branch represented by an edge.
• Refine a copied predecessor state according to the edge condition before joining it. The organisation of that refinement is part of your solution.
• postAbsTrace supplies predecessor post-states; preAbsTrace holds function-entry input.

Copy and refine one predecessor state before joining it:

AEState candidate = postAbsTrace.at(edge->getSrcNode());
const IntraCFGEdge* intra = SVFUtil::cast<IntraCFGEdge>(edge);
const SVFVar* condition = intra->getCondition();
s64_t successor = intra->getSuccessorCondValue();
// Intersect the condition or comparison-operand values in candidate with the
// constraint represented by successor, then write each refined value back,
// for example: candidate[refinedVarId] = AbstractValue(refinedInterval).
// If a required meet is bottom, this edge is infeasible and candidate must
// not be joined. The line below represents the feasible, non-bottom case.
incoming.joinWith(candidate);

Comparison predicates are queried through CmpStmt::getPredicate(). The AbstractValue and IntervalValue operations listed under Feature 1 can be used to compare, meet, and join refined values.

• initWTO, funcToWTO, ICFGSingletonWTO, and ICFGCycleWTO provide the interprocedural WTO.
• Options::WidenDelay() controls the number of precise iterations before widening.
• ander->getCallGraphSCC() and ander->inSameCallGraphSCC(caller, callee) provide call-graph SCC operations and identify recursive calls.
• getAEState, preAbsTrace, and postAbsTrace hold cycle snapshots and results.

Widening and narrowing return raw AbstractState values. Assign the result back to an AEState when updating the trace:

AEState& headState = getAEState(head);
AbstractState next = headState.widening(candidate);
headState = next;

• handleStubFunctions, handleCheckpointStubs, isExternalCallForAssignment, SVFUtil::isExtCall, updateStateOnCall, and inSameCallGraphSCC are supplied by the harness.
• State operations from Feature 1 model the values and memory changed by a summary.

isExternalCallForAssignment() recognises the assignment's supported API families. Use SVFUtil::isExtCall(function) for ordinary external-call routing. When propagating a completed call, use getRetICFGNode() and getActualRet() to update the caller-side return value.

For an external call with a return value, a summary can set that value to top and propagate the state to the return node:

AEState summary = getAEState(call);
const RetICFGNode* ret = call->getRetICFGNode();
summary.updateAbsValue(
    ret->getActualRet(), AbstractValue(IntervalValue::top()));
postAbsTrace[ret] = summary;

• getGepByteOffset, getGepElementIndex, getGepObjAddrs, and getAllocaInstByteSize recover access offsets and sizes.
• svfir->getBaseObject(id) and svfir->getGNode(id) resolve objects.
• BaseObjVar exposes size and black-hole metadata.
• reportBufOverflow(node) records a finding.

GepObjVar::getConstantFieldIdx() is a field index, not a general accumulated byte offset. Use getGepByteOffset() and maintain any required offset across GEP chains explicitly.

Given a resolved base-object ID, compare a direct GEP's byte-offset interval with the object size. A complete checker must additionally account for chained GEPs and external memory operations.

AEState& state = getAEState(gep->getICFGNode());
IntervalValue offset = state.getGepByteOffset(gep);
const BaseObjVar* base = svfir->getBaseObject(objectId);
u32_t size = base->getByteSizeOfObj();
if (offset.lb().getIntNumeral() < 0 ||
    offset.ub().getIntNumeral() >= static_cast<s64_t>(size))
    reportBufOverflow(gep->getICFGNode());

• IRGraph::NullPtr and NullMemAddr identify explicit null values.
• AbstractState::isNullMem, isBlackHoleObjAddr, and AEState::isFreedMem classify addresses.
• Load, store, GEP, and call statement queries expose dereferenced pointers.
• reportNullDeref(node) records a finding.

For a load, inspect the abstract addresses represented by its pointer operand:

const ValVar* pointer = SVFUtil::cast<ValVar>(load->getRHSVar());
AEState& state = getAEState(load->getICFGNode());
const AbstractValue& value = state.getAbsValue(pointer);
if (value.isAddr()) {
    for (u32_t addr : value.getAddrs())
        if (AbstractState::isNullMem(addr) || state.isFreedMem(addr))
            reportNullDeref(load->getICFGNode());
}

The helper names added privately by a complete solution are implementation choices, not required APIs. Students may organise these features differently or implement additional features.